Cyber GRC Specialist

Client of Stellar Hunters

Key Responsibilities

• Develop, maintain, and operationalize cybersecurity policies, standards, and procedures aligned with industry frameworks and regulatory requirements (e.g., NIST CSF, ISO 27001, SOC 2, PCI, relevant regional regulations).

• Support security governance forums and reporting to senior leadership and stakeholders on cyber risk, control effectiveness, and remediation progress.

• Collaborate with cross-functional teams to ensure security requirements are integrated into business processes, projects, and third-party relationships.

Risk Management & Assessments

• Conduct and coordinate risk assessments, control gap analyses, and threat/risk modeling for systems, applications, and third-party services.

• Maintain the risk register, prioritize remediation activities, and track closure of identified vulnerabilities and control deficiencies.

• Perform vendor security and risk assessments; review third-party contracts and recommend appropriate security controls and contractual language.

Compliance & Audit Support

• Support internal and external compliance initiatives, audits, and certifications (e.g., SOC 2, ISO 27001), including evidence collection, control testing, and remediation coordination.

• Monitor regulatory and industry compliance requirements and translate obligations into practical control and process requirements across the organization.

• Prepare and maintain documentation, control narratives, and artifacts required for assessments and regulatory inquiries.

Incident Response & Continuous Improvement

• Participate in incident response planning and post-incident reviews; advise on control improvements and regulatory/contractual notification considerations.

• Collaborate with Security Operations and IT teams to ensure controls are effectively implemented, monitored, and improved based on lessons learned and evolving threats.

• Identify opportunities to automate control monitoring, reporting, and GRC workflows using GRC platforms and security tooling.

Training, Awareness & Advisory

• Develop and deliver role-based security awareness, GRC guidance, and targeted training for employees, contractors, and business partners.

• Provide practical, risk-based advisory to Product, Engineering, IT, and business teams on secure design, control selection, and compliance requirements.

• Act as a trusted advisor for security and compliance questions related to new projects, cloud deployments, and third-party integrations.